Vendor description:-------------------"WSO2 Carbon redefines middleware by providing an integrated and componentizedmiddleware platform that adapts to the specific needs of any enterpriseIT project - on premise or in the cloud.100% open source and standards-based, WSO2 Carbon enables developers to rapidlyorchestrate business processes, compose applications and develop services usingWSO2 Developer Studio and a broad range of business and technical services thatintegrate with legacy, packaged and SaaS applications.The lean, complete, OSGi-based platform includes more than 175 components a OSGibundles or Carbon features. The WSO2 Carbon core framework functions asaEclipse for serversa and includes common capabilities shared by all WSO2products, such as built-in registry, user management, transports, security,logging, clustering, caching and throttling services, co-ordination, and aGUI framework."

Source: https://wso2.com/products/carbon/

"The WSO2 Dashboard Server (formerly WSO2 User Engagement Server) helps torapidly create visually appealing and engaging web components such asdashboards, and gadgets, and unlocking data for business intelligence andmonitoring. With the host of capabilities that Dashboard Server providesout-of-the-box, going from data to screen has never been easier."

Source: https://wso2.com/products/dashboard-server/

Business recommendation:------------------------SEC Consult recommends to perform a thorough security review conducted bysecurity professionals to identify and resolve all security issues.

Vulnerability overview/description:-----------------------------------1) Stored Cross-Site Scripting in WSO2 Dashboard (CVE-2018-8716)The dashboard is used by the end-users to manage their accounts, change passwords,alter their profiles, or change certain settings. An attacker is able to injectarbitrary JavaScript payloads into various textboxes (username, home address,lastname, firstname, etc).

The payloads are permanently stored in the dashboard and triggered every time thedashboard is visited. The payload is also potentially triggered in the carbonpart of WSO2, which means that an attacker would be able to inject payloadsfrom the front-end application into a middleware application, which is notaccessible from the internet and attack administrators.

It is suspected, that all user inputs are returned unfiltered in all server responses.

2) Stored Cross-Site Scripting in WSO2 CarbonTo demonstrate the vulnerability, it is sufficient to add a new BPS worker and setthe URL to the following payload: "><img src=x onerror=aler(document.cookie)>

Everytime the carbon middleware application is accessed, the payload is triggered.

Vulnerable / tested versions:-----------------------------The following version has been tested which was the most recent versionat the time of discovery:

* WSO2IS 5.3.0

Vendor contact timeline:------------------------2018-01-25: Contacting vendor through security@wso2.com2018-02-08: Asking for status update. Vendor responds, that they are still investigating the issue.2018-02-21: Vendor responds with release date and further details concerning the nature of the vulnerabilities. The XSS in the Carbon component was a duplicate and should be already fixed. Concerning the XSS in the dashboard a fix is implemented and will be rolled out with the release of WSO2 Identity Server 5.5.0.2018-03-14: Requesting CVE from Mitre for the stored XSS in the Dashboard.2018-03-15: Mitre assigned CVE-2018-8716.2018-03-26: Vendor informed us, that the final release of the updated software will be on 5th of April.2018-04-23: Public Release

About SEC Consult Vulnerability LabThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult. Itensures the continued knowledge gain of SEC Consult in the field of networkand application security to stay ahead of the attacker. The SEC ConsultVulnerability Lab supports high-quality penetration testing and the evaluationof new offensive and defensive technologies for our customers. Hence ourcustomers obtain the most current information about vulnerabilities and validrecommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Interested to work with the experts of SEC Consult?Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?Contact our local offices https://www.sec-consult.com/en/contact/index.html~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~